I don't get how the "Extensions" tab and button exist if you have not set the initial values. They are not rendered until the first save has been completed.

Unless someone is incorrectly shipping a pre-configured LocalSite.cfg. In which case, the initial password should probably be shipped with a default, since you are forcing configure to run in a non-standard sequence.

I suspect the "right" way to fix this is to change configure to use CGI::Session and require a login before accessing any parameters. I'm poking at that a little bit. Added FOSWIKICFGSID cookie and trying to get the login before allowing any access to the configuration. But it will be a bit before I know if it looks safe enough for 1.1.5.